nginx - Redun Blog

878 字

4 分钟

nginx

2026-01-05

nginx

1
# Nginx 日常运维命令与配置速查
2

3
> 覆盖安装、启动、热更新、HTTPS、反向代理、负载均衡、缓存、压缩、限流、日志切割等高频场景，拿来即用。
4

5
---
6

7
## 1. 安装 & 启停
8

9
```bash
10
# Ubuntu / Debian
11
sudo apt update && sudo apt install -y nginx
12

13
# CentOS / RHEL
14
sudo yum install -y epel-release && sudo yum install -y nginx
15

16
# 设为开机自启并立即启动
17
sudo systemctl enable --now nginx
18

19
# 平滑重载配置（**不断连接**）
20
sudo nginx -t   # 先检查语法
21
sudo nginx -s reload
22

23
# 快速停止 / 启动
24
sudo nginx -s quit   # 优雅退出
25
sudo nginx           # 直接启动

2. 配置结构速览#

1
/etc/nginx/
2
├── nginx.conf                 # 主配置
3
├── conf.d/                    # 自定义 *.conf 自动引入
4
├── sites-available/           # Ubuntu 风格：放置虚拟主机
5
├── sites-enabled/             # sites-available 的软链，真正生效
6
└── snippets/                  # 可复用代码段（ssl-params、proxy 头 等）

3. 虚拟主机模板#

1
server {
2
    listen 80;
3
    listen [::]:80;
4
    server_name  example.com www.example.com;
5

6
    # 强制跳转 HTTPS
7
    return 301 https://$server_name$request_uri;
8
}
9

10
server {
11
    listen 443 ssl http2;
12
    server_name example.com;
13

14
    # 证书路径
15
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
16
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
17
    include             /etc/nginx/snippets/ssl-params.conf;
18

19
    root /var/www/example;
20
    index index.html index.php;
21

22
    # 前端静态文件
23
    location / {
24
        try_files $uri $uri/ =404;
25
    }
26

27
    # API 反向代理
28
    location /api/ {
29
        proxy_pass         http://127.0.0.1:8080;   # 注意末尾斜杠
30
        proxy_set_header   Host $host;
31
        proxy_set_header   X-Real-IP $remote_addr;
32
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
33
        proxy_set_header   X-Forwarded-Proto $scheme;
34
    }
35

36
    # 资源缓存 30 天
37
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
38
        expires 30d;
39
        add_header Cache-Control "public, immutable";
40
    }
41
}

4. 反向代理 + 负载均衡#

1
# 上游后端池
2
upstream app_cluster {
3
    least_conn;                 # 最少连接算法（默认轮询）
4
    server 192.168.1.10:8080 max_fails=2 fail_timeout=3s;
5
    server 192.168.1.11:8080 max_fails=2 fail_timeout=3s;
6
    keepalive 32;               # 复用连接，减少握手
7
}
8

9
server {
10
    listen 80;
11
    server_name api.example.com;
12

13
    location / {
14
        proxy_pass http://app_cluster;
15
        include    proxy_params.conf;   # 统一头信息
16
    }
17
}

5. 限流（漏桶）#

1
# 定义区域：10MB 内存，速率 10r/s
2
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
3

4
server {
5
    location /api/ {
6
        limit_req zone=api burst=20 nodelay;
7
        proxy_pass http://app_cluster;
8
    }
9
}

6. Gzip 压缩#

1
gzip on;
2
gzip_vary on;
3
gzip_min_length 1k;
4
gzip_comp_level 6;
5
gzip_types
6
    text/plain
7
    text/css
8
    text/xml
9
    text/javascript
10
    application/json
11
    application/javascript
12
    application/xml+rss
13
    application/atom+xml
14
    image/svg+xml;

7. 浏览器缓存 & 跨域#

1
location ~* \.(?:css|js|jpe?g|png|gif|ico|svg|webp|woff2?)$ {
2
    expires 1y;
3
    add_header Cache-Control "public, immutable";
4
    add_header Vary Accept-Encoding;
5
}
6

7
# CORS
8
location /api/ {
9
    add_header Access-Control-Allow-Origin  "$http_origin" always;
10
    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
11
    add_header Access-Control-Allow-Headers "Authorization,Content-Type,Accept" always;
12

13
    if ($request_method = OPTIONS) {
14
        return 204;
15
    }
16
}

8. 日志切割（按天 + 压缩）#

1
/var/log/nginx/*.log {
2
    daily
3
    missingok
4
    rotate 30
5
    compress
6
    delaycompress
7
    notifempty
8
    create 640 nginx adm
9
    sharedscripts
10
    postrotate
11
        [ -s /run/nginx.pid ] && kill -USR1 `cat /run/nginx.pid`
12
    endscript
13
}

USR1 信号让 Nginx 重新打开日志文件（零停机）。

9. 一键 HTTPS（Let’s Encrypt）#

1
# 安装 certbot
2
sudo apt install -y certbot python3-certbot-nginx
3

4
# 自动获取证书并修改 Nginx 配置
5
sudo certbot --nginx -d example.com -d www.example.com
6

7
# 模拟自动续期
8
sudo certbot renew --dry-run
9
# 已写入 systemd timer，默认每日凌晨检查续期

10. 调试 & 排错锦囊#

1
# 1. 语法检查
2
sudo nginx -t
3

4
# 2. 查看编译参数 & 模块
5
nginx -V
6

7
# 3. 打印匹配到的 server_name
8
sudo nginx -T | grep -E 'server_name|listen' | grep -v '#'
9

10
# 4. 实时日志跟踪
11
tail -F /var/log/nginx/access.log | grep --line-buffered 404
12
tail -F /var/log/nginx/error.log
13

14
# 5. 压测验证
15
ab -n 10000 -c 100 https://example.com/

11. 性能调优片段#

1
# /etc/nginx/nginx.conf 主段
2
worker_processes auto;          # 自动按 CPU 核数
3
worker_cpu_affinity auto;       # 绑定 CPU
4

5
events {
6
    worker_connections  65535;  # 单进程最大连接
7
    multi_accept on;            # 批量建立新连接
8
    use epoll;                  # Linux 高效事件模型
9
}
10

11
http {
12
    sendfile on;
13
    tcp_nopush on;
14
    tcp_nodelay on;
15
    keepalive_timeout  65;
16
    client_max_body_size 100m;  # 上传大小限制
17
}

12. 常用信号表#

信号	作用
`nginx -s reload`	热重载配置（主进程发送 HUP）
`nginx -s quit`	优雅退出（worker 处理完当前连接）
`nginx -s stop`	立即退出
`kill -USR1 $(cat /run/nginx.pid)`	重新打开日志（切割用）
`kill -USR2 $(cat /run/nginx.pid)`	平滑升级二进制（热升级核心步骤）